FAILOVER

Starts a coordinated failover from a server to one of its replicas.

Browse all commands · Upstream source documentation

Reference field	Value
Canonical name	FAILOVER
Catalog group	Server commands
Upstream since	6.2.0 — upstream Redis/module version, not an ffkv release
Pinned catalog	Redis 8.10.0

Syntax

FAILOVER [TO host port [FORCE]] [ABORT] [TIMEOUT milliseconds]

ffkv behavior and limits

Server introspection describes ffkv, not a Redis process. MEMORY reports owned-allocation estimates, not jemalloc accounting. Administrative changes can affect all clients or persistent data; consult the scenario and operations guide before using destructive forms.

Source: README.md:393–395, 601–642; tests/bdd/features/server.feature; tests/bdd/features/catalog.feature.

Native RESP replication is asynchronous and distinct from HTTP snapshot polling. WAIT/WAITAOF barriers belong on the writing connection; acknowledgements do not certify failover safety. Upstream network policy and persistent storage must be configured deliberately (README.md:601–628).

All requests share the 8 MiB framing/1,024-argument ingress limit; normal RESP replies have 64 MiB wire/logical budgets with bounded nesting/value counts. Management and Lua origins impose smaller budgets. These are not a process RSS cap. Catalog inclusion is not exhaustive option or wire-format parity. See limits and compatibility.

Upstream metadata

The following fields come from the pinned Redis metadata, not measured ffkv performance or an assertion that ffkv enforces every upstream flag. Running COMMAND INFO/COMMAND DOCS describe the current engine.

Upstream Redis complexity: O(1)

Upstream arity: -1 (includes the command name; a negative number is a minimum).

Command flags: ADMIN, NOSCRIPT, STALE.

Argument structure

Argument	Type	Constraints / metadata
target	block	optional; token: TO
↳ host	string	Required
↳ port	integer	Required
↳ force	pure-token	optional; token: FORCE
abort	pure-token	optional; token: ABORT
milliseconds	integer	optional; token: TIMEOUT

Additional pinned upstream metadata

{
  "group": "server",
  "since": "6.2.0"
}

Metadata source · Local snapshot: src/command_metadata.json, key failover.

BDD coverage and source examples

These are source observations, not a test run performed by this documentation build. A tag identifies scenario intent; an extracted vector identifies a command invocation, which may intentionally produce an error. Scenarios may require setup, multiple connections, persistence, cluster nodes or native-module fixtures.

• A coordinated standalone handoff preserves writes and changes both roles — tests/bdd/features/replication.feature:298; command tag and invocation observed.
• Timeout and explicit abort remove the write pause without promoting a stale replica — tests/bdd/features/replication.feature:324; command tag and invocation observed.
• An implicit target performs the same coordinated role swap — tests/bdd/features/replication.feature:389; command tag and invocation observed.
• Explicit forced handoff can promote an owned target after the catch-up deadline — tests/bdd/features/replication.feature:403; command tag and invocation observed.

Extracted command vectors

The following JSON arrays are the test harness’s argument vectors, not shell commands. Numeric arguments are converted by the harness; objects of the form {"base64":"…"} represent decoded binary bytes, not a literal JSON command argument. Preserve scenario setup and connection ordering. See the CLI guide for shell quoting and binary stdin. No reply is invented or inferred.

Timeout and explicit abort remove the write pause without promoting a stale replica — tests/bdd/features/replication.feature:344 (node “master” executes:)

[
  "FAILOVER",
  "ABORT"
]

Next source assertion: the reply equals:

"OK"

An implicit target performs the same coordinated role swap — tests/bdd/features/replication.feature:391 (node “master” executes:)

[
  "FAILOVER",
  "TIMEOUT",
  "2000"
]

Next source assertion: the reply equals:

"OK"

A coordinated standalone handoff preserves writes and changes both roles — tests/bdd/features/replication.feature:304 (node “master” executes:)

Fixture-dependent: {{…}} tokens are replaced by the BDD runtime (for example, node ports, generated IDs or temporary paths). This is not a standalone executable command.

[
  "FAILOVER",
  "TO",
  "{{replica_host}}",
  "{{replica_port}}",
  "TIMEOUT",
  "2000"
]

Next source assertion: the reply equals:

"OK"